Re: High speed packet captures - libpcap with TPACKET_V3

[Jakub Zawadzki <darkjames-ws () darkjames pl>]

Hi,

On Sun, Nov 10, 2013 at 11:50:27AM +0100, Anders Broman wrote:
> The upcoming libpcap 1.5 have support for TPACKET_V3 which seems to 
> improve on packet drops at high sped captures.

Finally ;-)

> However some tests on a 1 Gb link with ~900 Mb/s indicates that tcpdump does better than dumpcap
> possibly because dumpcap uses "inpkts = pcap_dispatch(pcap_opts->pcap_h, 
> 1, capture_loop_write_packet_cb, (u_char *)pcap_opts);"  fetching 
> packets one by one rather than using -1.

Try saving in libpcap (not libpcap-ng) format, try to use threads (or not if you were using them).
Does it helps?
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe